Is CVE-2026-45089 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45089 being exploited in the wild.

How severe is CVE-2026-45089?

High severity, with a CVSS score of 8.2, published 27 May 2026.

Which products and versions are affected?

github.com/hahwul/dalfox (Go) SEMVER:introduced=0; github.com/hahwul/dalfox/v2 (Go) <= 2.12.0, SEMVER:introduced=0,fixed=2.13.0; Hahwul Dalfox <= 2.12.0.

Is there a fix for CVE-2026-45089?

Yes. github.com/hahwul/dalfox/v2 (Go): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45089 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45089?

Check whether you run github.com/hahwul/dalfox (Go), github.com/hahwul/dalfox/v2 (Go) or Hahwul Dalfox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45089: hahwul Dalfox unauthenticated arbitrary file write in REST API server mode

Q: Is there a fix for CVE-2026-45089?

Yes. github.com/hahwul/dalfox/v2 (Go): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45089 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-45089?

Check whether you run github.com/hahwul/dalfox (Go), github.com/hahwul/dalfox/v2 (Go) or Hahwul Dalfox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45089 · Severity: high · CVSS 8.2 · Published 2026-05-27

Dalfox, a tool used for scanning web applications for vulnerabilities, contains a flaw in its server mode that allows unauthenticated users to create or modify files on the host system. By sending a specially crafted request to the Dalfox API, an attacker can force the application to write log data to any file path they choose. This could lead to system instability, corruption of critical configuration files, or potentially allow an attacker to gain further access to the server.

Technologies: github.com/hahwul/dalfox (Go), github.com/hahwul/dalfox/v2 (Go), Hahwul Dalfox. Vendors: Go, Hahwul.

Quick answers

Is CVE-2026-45089 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45089 being exploited in the wild.
How severe is CVE-2026-45089?: High severity, with a CVSS score of 8.2, published 27 May 2026.
Which products and versions are affected?: github.com/hahwul/dalfox (Go) SEMVER:introduced=0; github.com/hahwul/dalfox/v2 (Go) <= 2.12.0, SEMVER:introduced=0,fixed=2.13.0; Hahwul Dalfox <= 2.12.0.
Is there a fix for CVE-2026-45089?: Yes. github.com/hahwul/dalfox/v2 (Go): upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45089 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45089?: Check whether you run github.com/hahwul/dalfox (Go), github.com/hahwul/dalfox/v2 (Go) or Hahwul Dalfox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/hahwul/dalfox/v2 (Go): upgrade to 2.13.0 or later
```
go get github.com/hahwul/dalfox/v2@v2.13.0
```

Technical details

Dalfox's REST API server mode fails to authenticate requests by default and does not sanitize the 'output', 'output-all', and 'debug' fields in the model.Options struct. When a scan is initiated via the API, these attacker-controlled fields are passed to the logging component. The logger opens the specified file path using os.O_APPEND|os.O_CREATE|os.O_WRONLY without verifying if the application is running in library/server mode. An unauthenticated remote attacker can exploit this to create new files or append log data (which includes the attacker-supplied URL) to existing files anywhere the process has write permissions. This vulnerability is rooted in CWE-306 (Missing Authentication) and CWE-73 (External Control of File Name or Path). Version 2.13.0 addresses this issue.

Affected products

hahwul Dalfox <= 2.12.0

Identifiers

CVE-2026-45089
GHSA-8hf9-3q64-q2qf
GO-2026-5257

Timeline

2026-05-07: disclosed: Initial disclosure on GitHub Advisory Database
2026-05-12: advisory: Advisory published
2026-06-08: other: Advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.